archive/fscan
1
0
Fork 0
mirror of https://github.com/shadow1ng/fscan.git synced 2026-09-22 03:10:42 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: 修复 dialer timeout 锁死、CVE 检测绕过 session 和误报问题

Browse Source
This commit is contained in:
ZacharyZcR
2026-04-28 09:40:13 +08:00
parent 91a9a1a11b
commit 08e2c4f74f
2 changed files with 8 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/session.go
+5 -5
View File
@@ -42,7 +42,7 @@ func (s *ScanSession) DialTCP(ctx context.Context, network, address string, time
}
// 获取 dialer
dialer, err := s.getDialer(timeout)
dialer, err := s.getDialer()
if err != nil {
LogError(fmt.Sprintf("获取代理拨号器失败: %v", err))
s.State.IncrementTCPFailedPacketCount()
@@ -60,18 +60,18 @@ func (s *ScanSession) DialTCP(ctx context.Context, network, address string, time
return conn, nil
}
func (s *ScanSession) getDialer(timeout time.Duration) (proxy.Dialer, error) {
func (s *ScanSession) getDialer() (proxy.Dialer, error) {
s.dialerOnce.Do(func() {
cfg := s.createProxyConfig(timeout)
cfg := s.createProxyConfig()
manager := proxy.NewProxyManager(cfg)
s.dialer, s.dialerErr = manager.GetDialer()
})
return s.dialer, s.dialerErr
}
func (s *ScanSession) createProxyConfig(timeout time.Duration) *proxy.ProxyConfig {
func (s *ScanSession) createProxyConfig() *proxy.ProxyConfig {
cfg := proxy.DefaultProxyConfig()
cfg.Timeout = timeout
cfg.Timeout = s.Config.Timeout
cfg.LocalAddr = s.Config.Network.Iface
// 优先 SOCKS5
plugins/services/telnet.go
+3 -11
View File
@@ -52,7 +52,6 @@ func NewTelnetPlugin() *TelnetPlugin {
func (p *TelnetPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {
config := session.Config
state := session.State
target := info.Target()
if config.DisableBrute {
@@ -91,7 +90,7 @@ func (p *TelnetPlugin) Scan(ctx context.Context, info *common.HostInfo, session
cveUsers = []string{"root", "admin", "administrator"}
}
for _, user := range cveUsers {
if vuln, cveUser, evidence := p.checkCVE202624061(info, config, state, user); vuln {
if vuln, cveUser, evidence := p.checkCVE202624061(ctx, info, session, user); vuln {
common.LogVuln(i18n.Tr("telnet_cve202624061", target, cveUser, evidence))
return &ScanResult{
Success: true,
@@ -773,8 +772,8 @@ func (p *TelnetPlugin) drainBuffer(conn net.Conn) {
// checkCVE202624061 检测 CVE-2026-24061 Telnetd Authentication Bypass 漏洞
// 利用 NEW-ENVIRON (option 39) 子协商注入恶意环境变量,实现认证绕过
// 返回 (是否漏洞, 触发用户名, 证据)
func (p *TelnetPlugin) checkCVE202624061(info *common.HostInfo, config *common.Config, state *common.State, user string) (bool, string, string) {
conn, err := net.DialTimeout("tcp", info.Target(), config.Timeout)
func (p *TelnetPlugin) checkCVE202624061(ctx context.Context, info *common.HostInfo, session *common.ScanSession, user string) (bool, string, string) {
conn, err := session.DialTCP(ctx, "tcp", info.Target(), session.Config.Timeout)
if err != nil {
return false, "", ""
}
@@ -995,13 +994,6 @@ func (e *cveChecker) run() (bool, string, string) {
return true, e.user, "[echo " + token + "]"
}
// 阶段 4: Shell prompt 特征
for _, pp := range []string{"# ", "$ ", "login: ", "Last login:", "Welcome to"} {
if strings.Contains(result, pp) {
return true, e.user, "[" + strings.TrimSpace(pp) + "]"
}
}
return false, "", ""
}